“AI” covers very different technologies, and governing them all the same way either over-regulates simple tools or under-protects powerful ones. This guide compares the main types, the risks that matter most for each and the controls that fit. Use it to decide how to tier your AI register.
Comparison
| Type | What it does | Characteristic risks | Key controls |
|---|---|---|---|
| Traditional machine learning and scoring models | Predicts or scores from structured data | Bias, drift, poor explainability, stale training data | Independent validation, fairness testing, drift monitoring, retraining governance |
| Rules and automated decisioning | Applies rules, often combined with model scores, to approve, route or rank | Unfair outcomes at scale, errors in rules, no way to appeal | Explanations, human review, appeals, decision logs, change control |
| Generative AI | Creates text, images, code or audio | Hallucination, IP and privacy exposure, misuse | Policy, content filters, review of outputs, labelling |
| Large language models | General-purpose language reasoning through prompts | Prompt injection, data leakage, inconsistent output, provider change | Guardrails, evaluation, PII redaction, version pinning, gateway |
| Retrieval-augmented generation (RAG) | Answers using retrieved organisational documents | Oversharing, stale or poisoned sources, ungrounded answers | Document-level access control, citations, retrieval tests, index hygiene |
| AI agents and multi-agent systems | Plans and takes actions using tools | Excessive agency, tool misuse, runaway cost, cascading errors | Least-privilege tools, sandboxing, approval gates, spend limits, kill switch |
| Computer vision and speech | Interprets images, video and audio | Unequal accuracy, surveillance and privacy concerns | Representative test data, consent, retention limits, human verification |
Why autonomy matters most
Risk rises with autonomy and consequence. A model that suggests a score for a person to review is lower risk than the same model that decides automatically. An assistant that drafts an email is lower risk than an agent that sends it and updates a record. Tier by what the system can do and who it affects, not by how advanced the technology sounds.
Different failure patterns
Predictive models tend to fail quietly: the world changes and accuracy decays. Generative systems fail visibly and plausibly: confident answers that are wrong. Agents fail by acting: a single bad step can write, send or spend. Governance needs monitoring for the first, grounding and review for the second and permissions and limits for the third.
Where laws and regulators come in
Existing Australian law applies whatever the technology: privacy, consumer, discrimination and administrative law. From 10 December 2026, covered organisations must describe in their privacy policy the kinds of decisions made or substantially assisted by computer programs that use personal information and significantly affect individuals, which can include rules engines as well as AI. The EU AI Act, by comparison, sorts systems by risk tier with stricter duties for high-risk uses, a useful reference for how to think about proportionality even where it does not apply.
Using the comparison
Record the type of each system in the register and attach the matching control set. Next read model risk management for scoring and decisioning, guardrails for LLM applications and agents and AI failure modes.
How EITSAA helps
We help you design and evidence AI governance that matches your risk, from the register and policy through to technical guardrails and audit-ready evidence. Explore AI Governance & Assurance, talk to our team or call 0402 401 584.
This is general guidance, not legal advice. Check current requirements with the relevant authority and take advice on your own position.